brahmiboudjema/cve-2020-25637-libvirt-double-freeDouble Free
CVE-2020-25637
*** Description ***
A double-free issue occurred in the libvirt API, in versions prior to version 6.8.0, responsible for requesting information about the network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The greatest threat of this vulnerability is to data confidentiality and integrity as well as system availability.
The most significant threat of this vulnerability concerns:
The scores of the flaw:
A moderate flaw by RedHat with an average score of 6.4
A moderate flaw by NVD with an average score of 6.7
*** Different tools and important prerequisites to exploit this vulnerability ***
First of all, it is necessary to check the compatibility of our operating system, simply run this command:
grep -E -c "vmx|svm" /proc/cpuinfo
If the command returns ok you can proceed with the installation:
sudo apt-get -y install qemu-kvm libvirt-bin virt-top libguestfs-tools virtinst bridge-utils
2) Installation of vagrant :
To install vagrant simply run this command:
sudo apt -y install vagrant
Once you have installed Vagrant and KVM, you should be ready to install a libvirt plugin to start managing KVM virtual machines using Vagrant.
vagrant plugin install vagrant-libvirt
You can confirm that the plugin was installed
vagrant plugin list
3) Vagrant box :
It is possible to use a ready-made template directly from Vagrant; in our case we will use an Ubuntu 20.04 image.
To add our image to the vagrant box simply run this command:
vagrant box add generic/ubuntu1804 --provider libvirt
To list the boxes present locally:
vagrant box list
4) Debugging
Two debugging options:
GDB, If the tool is not available on your operating system run this command:
sudo apt-get install gdb
Valgrind, If the tool is not available on your operating system run this command:
sudo apt-get install valgrind
*** Code execution ***
Launch a vm via vagrant:
vagrant up
First install the library:
sudo apt-get install -y libvirt-dev
Compilation:
gcc -g -Wall info1.c -o info1 -lvirt
Code execution:
./info1 qemu:///system vagrant-vms_ubuntu-01
Execution with debugging:
valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes --verbose --log-file=valgrind-out.txt ./info1 qemu:///system vagrant-vms_ubuntu-01
*** Activate the vulnerability ***
Before activating the vulnerability, understanding how the problematic function in libvirt works is essential.
Assume that an attacker can cause the use of a freed memory area via qemuAgentGetInterfaces() in libvirt, precisely in the memory area of the ifname variable, in order to cause a denial of service, and possibly execute code.
The expected moment has arrived.
Once the vagrant file is launched, the code info1.c must be run in a virtual machine itself launched by Qemu/KVM. So, create VMs inside a VM, i.e., execute the code in the VM created by vagrant.
*** Fix for this vulnerability ***
Simply set the ifname variable to null in the qemuAgentGetInterfaces() function of libvirt; that is, ifname should be freed for each interface.
*** Demonstration ***
You will find a simple demonstration of the problem (double free) in the PowerPoint file.
*** Important ***
The project is not completed to the end due to reasons of the vulnerability's complexity and hardware, as well as lack of time.